I am trying to get to know how Nextbike's API works. It's not a public API but capturing the outgoing traffic with my phone I can see all the traffic and endpoints that are being contacted.

I've stumbled upon a problem where the app calls the API and it uses an API key. That key hasn't been shared before and I don't know how it's calculated.

Even before attempting to log-in the phone makes some requests with the key. They key is of the form TR6EHaaNTSFGFmMt, with 16 characters. My problem comes here, is it randomly generated? Is it a hash of the IMEI/MAC Address? Is it possible to reverse it or know more or less how it's created? How can I know which hash function has been used?

My knowledge on cryptographic functions is still a bit limited.

1 Answer 1


The API key is maybe just a random hard coded secret. Take a look here: https://github.com/ikarulus/nextbike-api-reverse-engineering#obtaing-api-key

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.